DIALING BACK PHONE VERIFIED ACCOUNT ABUSE. Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks), Damon McCoy (GMU)

Transcription

1 DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks), Damon McCoy (GMU)

2 Keys to the kingdom

3 Blackmarket for bulk accounts

4 Existing protections CAPTCHAs verification IP reputation Phone verification

5 Existing protections CAPTCHAs verification IP reputation Phone verification OCR: 50% accuracy, $30/mo Human solver: >95% accuracy, $0.70 per 1K Mail.ru: $5 per 1K accounts Yahoo: $8 per 1K accounts Proxies: 15K - 30K IPs for $250/mo?

6 Phone verified accounts (PVA) x more expensive

7 Yet we see a steady stream of abusive PVA

8 Our work Deep dive into phone verified abuse Marketplace for accounts Origin of phone numbers Registration techniques Strengthen resource bottleneck for cheap phones

9 1 ACCOUNT BLACKMARKET

10 Advertisements for accounts Web storefronts Forums Freelance Listings

11 Blackmarket as an oracle Identify 14 merchants, track public pricing Purchase 2,217 Google PVA from 7 merchants Price: $ Authenticity: 100% working PVA Delivery rate: hours Disabled in 1 month: 68%

12 Prices range $ $600 $450 $300 $150 $0 Price per 1K accounts, multiple merchants

13 Price reflects quality $600 $450 $300 $150 $0 Original value of accounts Value lost to disabling

14 Pricing trends over 8 months Price per 1K accounts Prices over $150 remain stable $150 $125 $ % drop in price of Google PVA $85 $50 Does price reflect failure in defenses?

15 2 PHONE ORIGIN

16 Datasets Google PVA, disabled for abuse: 300,000 Purchases reveal sample is representative For each account: Associated carrier, country information Geolocation of signup IP CAPTCHA solution attempts

17 Weekly % of abusive PVA Phone country of origin 60% 40% 20% 0% Top origins United States India Indonesia Nigeria South Africa Bangladesh 27% 22% 12% 4% 4% 4%

18 VOIP largest abuse source Rank Carrier Bandwidth.com PT Bharti Vodafone MTN Idea Telekomunikasi Aircel Level 3 Cell Telengy Country US ID IN IN NG IN ID IN US ZA US Popularity 19.9% 7.3% 5.3% 4.0% 3.0% 2.8% 2.2% 2.1% 0.86% 0.84% 0.81% 24% of PVA verified over VOIP Includes: Google Voice Pinger TextPlus Enflick GoTextMe

19

20 Phone for price of a CAPTCHA Not Verified

21 Strategy in practice [now defunct] Free SMS Service New phone per CAPTCHA

22 Strategy in practice [now defunct] Free SMS Service New phone per CAPTCHA Google Voice Claim 5 forwarding numbers

23 Strategy in practice [now defunct] Free SMS Service New phone per CAPTCHA Google Voice Google Account Claim 5 forwarding numbers Register 5 accounts per phone number 25 accounts per CAPTCHA 60-80% of all disabled PVA between Oct-Jan

24 Where do non-voip phones originate? Same locations as human CAPTCHA farms. Socio-economic disparity creates an abuse vector.

25 $ per 1K SIMs

26 $ per 1K SIMs

27 Buyers bid on SMS endpoints: ~$0.20/SMS Sellers list phone numbers, respond with code.

28 3 REGISTRATION STRATEGIES

29 How do older protections perform? CAPTCHAs verification IP reputation Phone verification

30 CAPTCHA breaking 56% of registrations shown a CAPTCHA Correctly solved 96% of the time Indicative of human solvers

31 Minimizing IP re-use Restrict IP re-use over all time to < 20 accounts

32 Frequent phone re-use < 30% of phone numbers unique Can re-use phone numbers multiple times

33 Access to number is short lived Lifetime < 1hr compared to 1mo for benign

34 4 DIALING BACK ABUSE

35 Frequently abused carriers Over 1,000 abused carriers Top 10 carriers contribute 50% of abusive PVA

36 Carrier reputation Most VOIP registrations abusive All other carriers serve predominantly good users Rank Carrier Bandwidth.com PT Bharti Vodafone MTN Idea Telekomunikasi Aircel Country US ID IN IN NG IN ID IN % Good 41% 91% 98% 98% 97% 98% 99% 98%

37 Pushing back on abusive carriers In January, we took action on carrier abuse: Blocked VOIP numbers acquired with CAPTCHA Restricted all other known VOIP numbers to single use Restricted some Indian, Indonesian telcos to single use

38 Price per 1K accounts Impact on pricing Price returns back to pre-voip levels

39 How did merchants react? In April, purchase a new set of 2,478 PVA Only 12% were Bandwidth.com, compared to 80% before Some previously unseen VOIP services Merchants hit max registration limit Need finer grain phone reputation signals

40 Summary Thriving account black market Use purchasing as an oracle into criminal capabilities Use pricing as an early warning of failing defenses Phone verification requires reputation support

41 THANKS!